alternatively, you could just say "any token reachable through the user":

definition token {}

definition user {
  relation token: token
}

definition resource {
  relation viewer: user#token
  permission view = viewer
}